problem

The password reset endpoint has no restriction how often it can be used per user, so the mailbox of the user can be flooded. 

solution

• Restrict the usage per user, seams to be easy over the passwdresethash table, BUT:
• In order to prevent username guessing we can not use the passwdresethash table as it is, since it is using existing users. 
• Conclusion: The limiting of passwdreset URL calls must be done on the base of the given username - regardless if it exists or not. So for a specifc username the passwdreset should be only possible 3 times per hour.
• Also the cron should remove the the entries in the passwdresethash table older as 30 minutes